Executive brief
Bitwarden Server, the backend for the Bitwarden password management service, contained a security flaw in how it handles organization data imports. An authenticated user could bypass permission checks to inject unauthorized vault items (ciphers) into any organization's vault. This could lead to unauthorized data modification or the insertion of malicious entries into a corporate or shared password vault.
Technical details
A missing authorization vulnerability exists in Bitwarden Server's organization import functionality. The root cause is located in the `POST /ciphers/import-organization` endpoint, where submitting an empty `collections` array causes the server-side permission check (`CheckOrgImportPermission`) to be skipped. An attacker with any valid authenticated account can exploit this to inject ciphers (vault items) into organizations they do not belong to. This bypasses intended access controls that should restrict imports to users with 'CanCreate Collections' or 'AccessToImportExport' privileges. The issue is fixed in version 2026.4.1 by implementing more robust validation in the import logic.
Affected products
- Bitwarden Server < v2026.4.1
Timeline
- 2026-04-08: patched: Fix merged into main branch via PR #7394
- 2026-05-05: advisory: Release v2026.4.1 published
- 2026-05-11: disclosed: CVE-2026-43638 published to NVD
References
- https://github.com/bitwarden/server/commit/ebbf6dd0fa752114c09d73abb48ce32a50476758
- https://github.com/bitwarden/server/pull/7394
- https://github.com/bitwarden/server/releases/tag/v2026.4.1
- https://sanjokkarki.com.np/blog/bitwarden-import-org-bypass
- https://www.vulncheck.com/advisories/bitwarden-server-missing-authorization-via-organization-cipher-import